As cyber threats continue to expand in scale and sophistication, vulnerability discovery and responsible disclosure have become a critical component of the modern cybersecurity ecosystem. New vulnerabilities in network and information systems (NIS) are identified almost daily, and they may be discovered not only by ethical hackers or IT professionals, but also by malicious actors or hostile state entities. For this reason, it is essential that vulnerabilities are reported lawfully, responsibly, and in a coordinated manner.
What is a Vulnerability?
In this context, a vulnerability is defined as a weakness, error, or insecure configuration in a network or information system or its component that may be exploited for malicious purposes, resulting in a negative impact on data confidentiality, integrity, or availability.
The Role of NKSC in Vulnerability Disclosure
The National Cyber Security Centre (NKSC), as the authority responsible for implementing cybersecurity policy in Lithuania, plays a central coordinating role in the vulnerability disclosure process. NKSC continuously monitors, collects, and analyzes information related to cyber threats, vulnerabilities, and incidents, assesses the scope and impact of reported vulnerabilities, identifies affected entities, and facilitates secure information exchange between reporters and system owners.
In addition, NKSC ensures national-level visibility of vulnerabilities, issues early warnings, shares relevant information with stakeholders, and, where necessary, supports entities in mitigating vulnerabilities and assessing implemented security measures.
Principles of Responsible Vulnerability Discovery
Vulnerability discovery must be carried out responsibly and in compliance with the Cybersecurity Law, the National NIS Vulnerability Disclosure Procedure (NTISSA), and the disclosure policy (CVD) defined by the system owner. Key principles include:
- ● avoiding disruption of system operations and prohibiting DoS-type activities;
- ● minimizing potential impact and ceasing testing once a vulnerability is identified;
- ● ensuring data protection and avoiding unnecessary data processing;
- ● refraining from abusing obtained information or attempting unauthorized access;
- ● maintaining confidentiality and avoiding public disclosure;
- ● reporting vulnerabilities within 24 hours of discovery;
- ● ensuring transparency and cooperation with NKSC and affected entities.
Failure to comply with these principles may result in legal consequences.
Significant and Non-significant Vulnerabilities
Only vulnerabilities that pose a real and justified risk to the security of NIS or the data they process should be reported. Significant vulnerabilities include those that enable authentication or authorization bypass, unauthorized access to non-public data, execution of unauthorized code, or arise from critical configuration errors.
Conversely, theoretical vulnerabilities without real impact, denial-of-service weaknesses, outdated browser XSS issues, or self-inflicted attack scenarios are generally not considered significant and do not require reporting.
Vulnerability Discovery Methods
Safe discovery methods are strongly recommended. Priority should be given to passive or manual testing, while aggressive automated tools and large-scale fuzzing should be avoided. All testing activities must be documented, and vulnerabilities should be supported by clear evidence without compromising system availability or data integrity.
Reporting and Public Disclosure Procedures
Vulnerabilities may be reported directly to the affected entity in accordance with its CVD policy or to NKSC via email or an official reporting form. Anonymous reporting is permitted, provided the reporter retains all relevant evidence.
Public disclosure is permitted only in compliance with NTISSA and the established CVD process. Uncoordinated disclosure is considered irresponsible and may expose systems to exploitation and reporters to legal risk.
Summary
Responsible vulnerability disclosure is a fundamental element of strengthening cybersecurity across organizations and at the national level. Adhering to legal, technical, and ethical principles ensures that discovered vulnerabilities contribute to improved security rather than becoming an additional source of risk.
Have more questions or want to know more about vulnerability disclosure best practice? Let's talk!